PT-2026-57317 · Frappe · Frappe

CVE-2026-48127

Published

2026-07-10

Updated

2026-07-10

CVSS v4.0

5.3

Medium

Vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.20.0 Frappe versions prior to 15.110.0

Description Users without write access can attach files to any doctype by utilizing file-handling API endpoints, such as add attachments.

Recommendations Update to version 16.20.0 or newer. Update to version 15.110.0 or newer.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-48127

GHSA-FWRV-4RW4-97FW

Frappe